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Abstract 

We present a method for computing period lattices and elliptic loga- 
rithms for elliptic curves defined over C, using the complex Arithmetic- 
Geometric Mean (AGM) first studied by Gauss. Earlier authors have only 
considered the case of elliptic curves defined over the real numbers; here, 
the multi-valued nature of the complex AGM plays an important role. 
Our method, which we have implemented in both MAGMA and Sage, is 
illustrated with several examples. 



1 Introduction 

Let E be an elliptic curve defined over C, given by a Weierstrass equation 

E: Y 2 = i(X - ei )(X - e 2 ){X - e 3 ), 

where the roots ej £ C are distinct. As is well known, there is an isomorphism 
(of complex analytic Lie groups) C/A = E(C), where A is the period lattice of E: 
specifically, we take A to be the lattice of periods of the invariant differential 
dX/Y on E. It is a discrete rank 2 subgroup of C, spanned by a Z-basis {wi,W2} 
with ui2 jw\ ^ R. The isomorphism is given by the map 

z (mod A) h. P = (p A (z), p' A (z)) £ E(C) 

(with (mod A)h>0€ E(C), the base point at infinity) where pA denotes the 
classical elliptic Weierstrass function associated to the lattice A. The inverse of 
this map, 

P M> z (mod A), 

from E(C) to C/A, is called the elliptic logarithm, and we say that any z £ C 
representing its class modulo A is an elliptic logarithm of P. Two natural 
questions are: 

1. How can we compute a basis for the period lattice A of E, given a Weier- 
strass equation? 

2. Given a point P = (x,y) £ E(C), how can we compute its elliptic loga- 
rithm z E C? 



1 



For elliptic curves over K, these questions have been answered satisfactorily 
and are well-known. Algorithms for computing Z-bases for period lattices of 
elliptic curves defined over R, and elliptic logarithms of real points on such 
curves, may be found in the literature (see, for example, [21 Algorithm 7.4.8] 
or [5j §3.7]). These use the real arithmetic-geometric mean (AGM), and allow 
one to compute both values rapidly with a high degree of precision. The theory 
behind this method is described succinctly by Mestre in [2]. The situation for 
elliptic curves over C, however, is less satisfactory. 

In this paper, we will give a complete method for computing period lattices 
and elliptic logarithms for elliptic curves over C, by generalising the real algo- 
rithm. To this end, we will first explain the connection between the following 
three classes of objects: 

• Complex AGM sequences, as first studied by Gauss and explored in depth 
more recently by Cox pQ; 

• Chains of lattices in C; 

• Chains of 2-isogenies between elliptic curves defined over C. 

These will be defined precisely below. This connection will allow us to derive 
an explicit formula (see Theorems HUl and |2"T1 below) . based on so-called optimal 
complex AGM values, for a Z-basis of the period lattice of any elliptic curve 
defined over C. We then develop our method further to give an iterative method 
( Algorithm 1281) for computing elliptic logarithms of complex points. 

Our approach to the computation of periods follows closely that of Bost and 
Mestre £5] in the real case. However, in that case there is only a single chain of 
2-isogenies which needs to be considered, and a unique AGM sequence, while 
over C we find it convenient to consider a whole class of such sequences. The 
connection between these three types of sequence has some independent interest. 

We note that the recent paper by Dupont [5J also presents related methods 
for evaluating modular functions using the complex AGM, including explicit 
complexity results. The results in [B] may also be used to compute complex 
periods, as these are given by elliptic integrals with complex parameters. 

In the next three sections of the paper we consider in turn complex AGM 
sequences (as are described well in Cox [J]), then lattice chains and finally 
chains of 2-isogenies. Then we give the first application, to the computation 
of a basis for the period lattice (see Theorem l2~Tj) . The following section gives 
a new proof of a result about the complete set of values of the (multi-valued) 
complex AGM, slightly more general than the version in [4]. Then in Section [8] 
we develop the elliptic logarithm algorithm (Algorithm |28|) . The paper ends 
with a set of illustrative examples. 

Our algorithms have been implemented by the authors both in Sage (see [5]) 
and in MAGMA (see [I], code available from the second author). 

The results of this paper form part of the PhD thesis [9 of the second au- 
thor. The proofs are in some cases different: in [9] both the periods and elliptic 
logarithms are expressed more traditionally, as integrals over the Riemann sur- 
face E(C); however the resulting iterative algorithms are identical. The second 
author acknowledges the support of the Development and Promotion of Science 
and Technology Talent Project (DPST) of the Ministry of Education, Thailand. 
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2 AGM Sequences 



Let (a, b) € C 2 be a pair of complex numbers satisfying 



a ^ 0, b ^ 0, a^±b. 



(1) 



We say that (a, 6) is good if 5R(6/a) > 0, or equivalently, 



\a-b\ < |o + 6|; 



(2) 



otherwise the pair is said to be bad. Clearly, only one of the pairs (a, 6), (a, —6) 
is good, unless 5R(b/a) = (or equivalently, \a — b\ — \a + b\), in which case both 
are good. 

An arithmetic- geometric mean (AGM) sequence is a sequence ((a„, 6 n ))^L , 
whose pairs (a„, 6„) 6 C 2 satisfy the relations 



for all n > 0. It is easy to see that if any one pair (a n ,b n ) in the sequence 
satisfies (TTJ) then all do, and we will make this restriction henceforth. 

From any given starting pair (do, &o) there are uncountably many AGM se- 
quences, obtained by iterating the procedure of replacing (a n , b n ) by the arith- 
metic mean a„+i = (a„ + b n )/2 and the geometric mean b n +i = \/a n b n , with 
a choice of the square root for b n +\ at each step. However, we usually prefer 
to consider the entire sequence as a whole. We say that an AGM sequence is 
good if the pairs (a n ,b n ) are good for all but finitely many n. A good AGM 
sequence in which (a n ,b n ) are good for all n > is said to be optimal, and 
strongly optimal if in addition (ao, &o) is good. If an AGM sequence is not good, 
then we say that it is bad. 

It is easy to check that (a n +i, ±6„+i) are both good if and only if a n /b n 
is real and negative, in which case (a n ,b n ) is certainly bad. In an optimal 
sequence, this situation can only occur for n = 0. In consequence, for every 
starting pair (ao,0o) there is exactly one optimal AGM sequence, unless ao/feo 
is real and negative, in which case there are two, with different signs of b\, 
with the property that the ratios a n /b n in one of the sequences are the complex 
conjugates of those in the other. 

The following proposition is from Cox (see [4]); the proof of parts (1) and (2) 
is elementary, and we refer the reader to 4 ; part (3) appears deeper, and we 
will give a proof below after relating the different AGM values to a certain set 
of periods of an elliptic curve. Note that Cox defines the notion of "good" more 
strictly than above (when 5R(a/6) = he requires 9(a/6) > 0, so that exactly 
one of (a, ±6) is good in every case), but in view of the preceding remarks this 
does not affect the following result. 

Proposition 1. Given a pair (ao,&o) G C 2 satisfying (TTJ), every AGM sequence 
((a n ,b n ))%L starting at (ao,&o) satisfies the following: 

1. lim„_ ! . 00 a n and lim Il _ i . 00 b„ exist and are equal; 

2. The common limit, say M , is non-zero if and only if the sequence is good; 

3. \M\ attains its maximum (among all AGM-sequences starting at (ao,bo)) 
if and only if the sequence is optimal. 
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For an AGM sequence ((a n ,b n ))^L starting at (a ,bo), we will denote the 
common limit lim„_ s . 00 a n — lim„_ > . 00 b n by Ms(ao,bo), where S C Z>o is the 
set of all indices n for which the pair (a n ,b n ) is bad. For example, M^(ao,bo) 
denotes the common limit for the optimal AGM sequence. To avoid ambiguities 
when ao/b is negative real, we may agree to choose b\ so that S(ai/&i) > 
in that case, though this choice will not affect our results below. Note that the 
AGM sequence is good if and only if S is a finite set. To ease notation, we shall 
write M^(ao,bo) simply as M(ao,bo). 

3 Lattice Chains 

In this paper, a lattice will always be a free Z-module of rank 2, embedded as a 
discrete subgroup of C. Elements of lattices will often be called periods, since in 
our application the lattices will arise as period lattices of elliptic curves defined 
over C. 

The following definition, as well as Lemma [2j only depend on the algebraic 
structure of lattices. We define a chain of lattices (of index 2) to be a sequence 
of lattices (A ra )^ which satisfies the following conditions: 

1. A n D A n+ i for all n > 0; 

2. [A„ : A„+i] = 2 for all n > 0; 

3. Ao/A„ is cyclic for all n > 1; equivalently, A n +i 7^ 2A n _i for all n > 1. 
Thus for each n > 1 we have 

A n+1 = (w) + 2A„ (3) 

for some w G A„\2A„_i. Given an initial lattice Ao, there are three possibilities 
for Ai. When n > 1, one of the three sublattices of index 2 is excluded, since it is 
contained in 2A„_i (which would contradict the last condition in the definition), 
and so there are only two possible choices for A n +i. The number of such chains 
starting with A is uncountable; we will distinguish a countable subset of these 
as follows. Let 

00 

Aoo = pi a„. 

Then A m is free of rank at most 1; the rank cannot be 2, since for all n, 

[A : A^] > [Ao : A n ] = 2", 

so [Ao : Aqo] is infinite. We say that the chain is good if Aqo has rank 1; in this 
case a generator for Aqo will be called a limiting period of the chain. We will 
first show that the limiting period is primitive, i.e. not in mAo for any m > 2. 

Lemma 2. Let (A„)^L be a good chain with Aqo = (woo)- Then 

1. Woo is primitive; equivalently, Ao/Aqq is free of rank 1; 

2. A n = (woo) + 2™A for all n>0. 
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Proof. Suppose that Woo = mw for some m > 1 and w € A . If m is odd, then 
since Ao/A n has order 2™ which is prime to to, we see that 

mw e A„ =>■ w e A„ 

for all n, so that w € Aoo- Hence (by definition of Woo), m = 1. 

Next suppose that Woo = 2w for some w £ Ao. By definition of Woo, we then 
have w Aoo, and hence there exists n > such that w ^ A n . This implies 
that Woo G A„ \ 2A„. But since <E A n+ i, we have 

A„+i = (tOoo) + 2A„ = (2w) + 2A„ + i C 2A , 

which contradicts the definition of a chain. This proves the first statement. 

The second statement follows from the fact that A„/2 n Ao is cyclic of order 
2™, and is generated by w m modulo 2™Ao, since Woo is primitive. □ 

So far, our notion of a good chain has been defined as a property of the chain 
as a whole, and only used the abstract structure of lattices as free Z-modules. 
Using the next definition, we will see that this property can also be seen in 
terms of the individual steps A„ D A n+ i, when the lattices are embedded in C. 
In view of ©, the choice of A„ + i is determined by the class of w modulo 2A„. 

For n > 1, we say that A n+ i C A„ is the right choice of sublattice of A„ if 
A n+ i = (w) + 2A„ where w is a minimal element in A n \ 2A„_i (with respect 
to the usual complex absolute value). 

Lemma 3. Let (A„)^L be a good chain with — (w^,). Then Woa is minimal 
in A n for all but finitely many n > 0. 

Proof. Since Ao is discrete, the number of periods w e A with < |w| < |u>oo| 
is finite. Each of these periods lies in only finitely many A„ by minimality of Woo 
in Aqo, so there exists no such that u>oo is minimal in A„ and hence also in A„ 
for all n > uq. □ 

The following proposition yields an alternative notion of a good chain. For 
now we remark that this is analogous to the definition of a good AGM sequence 
in the previous section; more of its analogues will be seen in later sections. 

Proposition 4. A chain of lattices (A n )^L is good if and only if A„ + i C A„ 
is the right choice for all but finitely many n > 1 . 

Proof. Let (A„)^° =0 be a good chain with Aoo = (woo)- Then by Lemma |31 
there exists an integer no such that Woo is minimal in A„ for all n > uq. Since 
A Jl+ i = (woo) + 2A n for all n, then by definition, A n+ i C A„ is the right choice 
for all n > no. 

Conversely, suppose that A„ + i C A n is the right choice for all n > no (where 
no > 1)- Without loss of generality, we may suppose that no = 1. Let w\ € Ai 
be a minimal element. Then wi is certainly primitive (as an element of Ai, 
though not necessarily in Ao). We claim that wi € A„ for all n > 1, so that the 
chain is good with limiting period w\. 

To prove the claim, suppose that ui\ S A^- for all j < n. Then A„ = (wi) + 
2"~ 1 Ai, since the latter is contained in the former and both have index 2" _1 in 
Ai. Hence A„ = (wi, 2™~ 1 W2), where W2 G Ai is such that Ai = (w\, W2). The 
right sublattice of A„ + i is clearly {ui\) + A„, by minimality of w\ (which is a 
candidate since w\ g A„ \ 2A„_i); in particular, w\ G A n +i, as required. □ 
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3.1 Optimal Chains and Rectangular Lattices 



Let us define a lattice chain to be optimal if A„ + i C A„ is the right choice for 
all n > 1. We will see that there is in general just one optimal chain for each 
of the three choices of Ai C Ao. In order to make the statement more precise, 
however, some preparation is necessary. 

We say that a lattice A C C is rectangular if it has an "orthogonal" Z- 
basis {wi,w 2 }, i.e. one which satisfies $t(w2/wi) = 0. For example, the period 
lattice of an elliptic curve defined over K with positive discriminant is rectan- 
gular, where an orthogonal basis is given by the least real period and the least 
imaginary period. In general, rectangular lattices are homothetic to the period 
lattices of this family of elliptic curves. 

If {u>i, w 2 } is any Z-basis for a lattice A, the three non-trivial cosets of 2 A 
in A arc Cj = Wj + 2A for j = 1, 2, 3, where u> 3 = w\ + w 2 . By a minimal coset 
representative in A we mean a minimal element of one of these cosets. Minimal 
coset representatives are always primitive; for they are certainly not in 2A, and 
if w = mw' with m > 3 odd, then \w'\ < \w\ while w' is in the same coset as w. 

Lemma 5. In each coset Cj the minimal coset representative is unique up to 
sign, except in the case of a rectangular lattice with orthogonal basis {w\,W2} 
where the coset C3 has four minimal vectors, ±(w\ ± w 2 )- 

Proof. For a rectangular lattice with orthogonal basis {w\, W2}, it is easy to see 
that the minimal coset representatives are as stated. Conversely, suppose that 
the lattice A has a coset C with at least two pairs of minimal elements, ±w and 
±w'. Then w\, W2 = (w ± w')/2 <G A are easily seen to be orthogonal. 

If wi = (mod 2A), then u> 2 = w (mod 2A). But then |w 2 | < |u>i + 
w 2 | = M, contradicting minimality of w in its coset. Hence w\ ^ (mod 2A). 
Similarly, W2 ^ (mod 2A). Moreover, w\ =k W2 (mod 2A) since w = w\ + 
u>2 = w\ — u>2 ^ (mod 2A). Therefore, Wi,W2,w do represent the three 
non-trivial cosets modulo 2A. Now if {tui,w 2 } was not a Z-basis, there would 
exist a non-zero period wq — aw\ + fiw2 with < a, < 1. But then one of 
wo, u>o — wi, wq — W2, wo — w is in the same coset as w, and all are smaller, 
contradiction. □ 

Our algorithm for computing periods of elliptic curves will in fact compute 
minimal coset representatives. Although these are individually primitive, to 
ensure that we thereby obtain a Z-basis for the lattice, the following lemma is 
required. 

Lemma 6. For j = 1,2,3, let Wj be minimal coset representatives for a non- 
rectangular lattice A C C; that is, minimal elements of the three non-trivial 
cosets of 2A in A. Then any two of the Wj form a Z-basis for A, and w 3 = 
±(wi ± 1^2)- 

Proof. We may assume that \w\ \ < |w 2 | < l w 3|- Then w\ is minimal in A and 
w 2 is minimal in A\ (wi). Hence (replacing W2 by —W2 if necessary) r = w^/wi 
is in the standard fundamental region for SL2 (Z) acting on the upper half-plane, 
{wi, W2} is a Z-basis, and W3 = W2 ± w\; the sign depends on that of 5R(t). □ 

The following proposition shows that the limiting period of an optimal chain 
is closely related to minimal coset representatives. 
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Proposition 7. A good chain of lattices (A n )^° =0 with Aoo — (woq) is optimal 
if and only if is a minimal coset representative of 2 Ao in Aq . 

Proof. Suppose that w^, is a minimal coset representative. Then it is clear that 
A n+ i = (Woo) + 2A„ C A„ is the right sublattice for all n > 1, since is 
certainly minimal in A„ \ 2A„_i. 

Conversely, suppose that the sequence is optimal. Let w be a minimal el- 
ement of Ai \ 2Ao, so that w is a minimal coset representative for the unique 
non-trivial coset of 2Ao which is contained in Ai. Note that w is unique up to 
sign, unless Ao is rectangular in which case (for one of the cosets) there will be 
two possibilities for w up to sign. By optimality, the sublattice A2 C Ai is the 
right choice. In particular, if Ao is not rectangular, then we must therefore have 
A2 = (w) + 2Ai. This, however, may not hold in the rectangular case, but it 
will hold if we replace w by the other choice of minimal coset representative. 

Now we claim that A„ = (w) +2A„_i for all n > 2. We already know this for 
n = 2. If the claim is true for n, then certainly w G A„ \ 2A„_i (since w ^ 2Ao), 
so the (unique) good choice of sublattice of A„ is (w) + 2A„. By optimality, 
this is A n+ i, and so the claim holds for n+ 1. Thus w € H^Lo ^™ = ( w oo), and 
indeed, w = luioo, since w is primitive. □ 

Combining Lemma [3] with Proposition we have the following conclusion. 

Corollary 8. Every non-rectangular lattice A has precisely three optimal sub- 
lattice chains, whose limiting periods are the minimal coset representatives in 
each of the three non-zero cosets of 2 A in A. Every rectangular lattice A has 
precisely four optimal sublattice chains. 

4 Short lattice chains and level 4 structures 

In this section we establish a link between AGM sequences and lattice chains. 
The first step is to associate a pair of nonzero complex number (a, b) (with 
a 7^ ±b) to each "short" lattice chain A D Ai D A2 in such a way that (a, b) is 
good in the sense of Section [2] if and only if A2 is the right choice of sublattice 
of Ai , in the sense of Section [31 

We establish bijections between the following sets: 

1. "short" lattice chains Ao D A2 with A0/A2 cyclic of order 4; 

2. triples (E, u>, H) where E is an elliptic curve defined over C, uj a holomor- 
phic differential on E, and H c E(C) a cyclic subgroup of order 4; 

3. unordered pairs of nonzero complex numbers a, b with a 2 ^ b 2 , where the 
pairs a, b and —a, —6 are identified. 

For each short lattice chain Ao D A2, if we set Ai = A2 + 2Ao then (Ao, Ai, A2) 
satisfy the conditions for the first three terms in a lattice sequence as defined 
earlier. Hence we will usually think of a short lattice chain as a triple Ao D 
Ai 3 A2, even though Ai is uniquely determined by the other two. 

To each short lattice chain we associate the elliptic curve E = C/Ao with 
differential u) — dz and subgroup H = (l/4)A2/Ao. Conversely, to a triple 
(E, uj, H) we associate the chain Ao D A2 where Aq is the lattice of periods of oj 
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(so that E(C) = C/A ), and A 2 is the sublattice such that H = (1/4)A 2 /A 
under this isomorphism. 

Each triple (E,u,H) has a model of the form 

E {aM : Y 2 = 4X(X + a 2 )(X + b 2 ), 

for some unordered pair »,leC* such that a 2 ^ b 2 , where uj = dX/Y, and H 
is the subgroup generated by the point 

P{a,b} = (ab,2ab(a + b)). 

The four points P {±a , ±b} are the solutions to 2P = T = (0,0) G E {aM (C)[2}. 
Interchanging {a, b} and {— a, — b} docs not affect the curve and interchanges 
P{ a M an d P{- a ,-b\ = — P{a,b} so does not change H. On the other hand, 
changing the sign of just one of a, b changes H to the other cyclic subgroup of 
order 4 containing T. Hence the pair {a, b} has the properties stated and is 
well-defined up to changing the signs of both a and b, 

Conversely, given {a, 6} with ab =/= and a =/= ±b, we recover the triple 
(-E '{ a , b} ,u,H), which is unchanged by either interchanging a and b or negating 
both'. 

If we only consider elliptic curves up to isomorphism, we may ignore the 
differential oj, scale the equations arbitrarily, and consider lattices only up to 
homothety. Now we can identify pairs {a, b} and {ua,ub} for all aeC. The 
equation for E^ a b j can be scaled so that ab = 1, giving the homogeneous form 

Ef. Y 2 = 4X(X 2 + fX + 1), 



where 



ao o a 



In this model, the points ±Pr a fc j generating the distinguished subgroup H 
now have coordinates (1, ±2-^/2 + J). Thus the pair E,H uniquely determines 
a complex number / e C \ {±2}. We call this / the modular parameter for the 
level 4 structure, since (as we will see below) it is in fact the value of a modular 
function for the congruence subgroup To (4). 

Proposition 9. The above constructions give a bijection between these sets: 

1. "short" lattice chains Ao D A 2 up to homothety; 

2. pairs (E,H) where E is an elliptic curve defined over C with H C E(C) 
a distinguished cyclic subgroup of order 4 ; up to isomorphism ( where iso- 
morphisms preserve the distinguished subgroups); 

3. complex numbers f G C \ {±2}. 

4- points in the open modular curve Fo(4) = ro(4)\"H, where % denotes the 
upper half-plane. 

Remark. It would appear that considering pairs (E,P), where P is a point 
of exact order 4 in E(C), would give a refinement to the level 4 structure, 
corresponding to points on the modular curve Yi(4) = ri(4)\"H, since [To (4) : 
Ti(4)] = 2. However, this is an illusion: since every E has an automorphism 
[—1] which takes P to — P, the set of pairs (E, H) (up to isomorphism) may be 
identified with the space of pairs (E,P) (also up to isomorphism). Similarly, 
since T (4) = (±/)ri(4), we may identify Yi(4) and T (4). 
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Proof. Bijections between all sets except the last have already been established. 

Up to homothety, the lattice A is determined byreH modulo the action 
of the modular group T = SL(2,Z): for any oriented basis wi, u> 2 of A (where 
"oriented" means W2/1V1 £ T-L) we associate r = 102/wi £ H. All oriented bases 
w[ , w' 2 of Aq have the form 



w 2 = aw2 + bwi 
w[ = CW2 + dw\ 



wittQ 7 = ^ e T, and r' = K^A^i = ( ar + b )/( CT + To auow for 

the additional level 4 structure, we restrict to oriented bases wi,W2 such that 
A2 = (wi) + 4Ao, so that w[,w 2 is only admissible if w\ = ±w[ (mod 4Ao), or 
equivalently (c, d) = (0, ±1) (mod 4). This uniquely determines the To(4)-orbit 
of t and not just its T-orbit. 

Let Yq(4) = Tq(A)\H denote the open modular curve associated to To (4), and 
Xo(A) its completion, obtained by including the three cusps (represented by 00, 
and 1/2 £ P 1 (Q)), which has genus 0. Hence the function field of ATo(4) is gen- 
erated by a single function. Since the j-invariant of Ef is 256(/ 2 — 3) 3 / (/ 2 — 4), 
we see that / = /(r) is a suitable function. This establishes the claim concern- 
ing /, and completes the proof of the proposition. □ 

Remark. There is an involution on each of these sets, which preserves the level 2 
structure but interchanges the two possible associated level 4 structures. In each 
of the sets this takes the following forms: replace A2 by the other sublattice A' 2 
of index 2 in Ai such that Ao/AJ, is cyclic; replace H by the other subgroup H' 
which is cyclic of order 4 and contains T — (0, 0); change the sign of one of a, b; 
or change / to — /. This involution comes from the nontrivial automorphism of 
the cover X (A) —> X (2) of degree 2; the function field of X (2) is generated 
by P- 

Remark. Since ^ T (4) ^ = T(2), the function field of X (4) 

may also be generated by A(2r) where A(r) is the classical Legendre elliptic 
function which generates the function field of X(2). A calculation shows that 
f(r) — 2(1 + A(2r))/(1 — A(2r)). One interpretation of this is that instead 
of parametrizing short lattice chains by the parameter r £ lo(4) corresponding 
to Ao with ro(4)-structure, we could instead have used the parameter 2r £ Y(2) 
to parametrize the middle lattice Ai with full level 2-structure given by the 
sublattices ^A and A 2 . 

We now state the main result of this section. 

Theorem 10. Let A D Ai D A2 be a short lattice chain corresponding to 
the unordered pair {a, b} and modular parameter f. Then the following are 
equivalent: 

1. A2 is the right choice of sublattice of A±; 

2. the pair (a, b) is good; 

3. »(/) > 0. 



lr The reason for ordering bases this way is to maintain consistency with other sections. 
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Proof. Equivalence of the second and third conditions is immediate from / = 
a/b + b/a since (a, b) is good if and only if $t(a/b) > 0. (In terms of the Legendre 
function, the equivalent condition is that |A(2t)| < 1.) 

For equivalence of the hrst condition, we need to work harder. Recall that 
A 2 is the right choice of sublattice if A 2 = (w\) + 2Ai = (wi) +4A , where w\ is 
the minimal period in its coset modulo 2K\. We now characterize this condition 
in terms of the imaginary part of r € H. 

Lemma 11. Let W\,W2 be any oriented basis for Ao such that A 2 = (wi)+4Ao, 
and let t = w 2 jw\ . The following are equivalent: 

1. 3t is maximal, over all t in its T {4)-orbit; 

2. \ct + d\ > 1 for all coprime c,d G Z such that (c, d) = (0, ±1) (mod 4); 

3. \wi\ is minimal, over all primitive periods of A such that A 2 = (wi)+4A ; 
4- \t + d/4\ > 1/4 for all odd del. 

Proof. Equivalence of the first two statements follows from 3(7t) = ^sT/\cT+d\ 2 



is also equivalent to these. For the last statement, consider the geometry of the 
upper half-plane: the region given by these conditions are the same: (4) states 
that r lies on or above all the semicircles centred on rationals with denominator 4 
and with radius 1/4, while (2) says that r lies above all semicircles centred 
at rationals — d/c with radius 1/c for which (c, d) = (0,±1) (mod 4); as the 
semicircles for c > 4 lie strictly under those for c = 4, this is no stronger. □ 

We denote by .F(4) the set of r which satisfy these conditions; that is, those 
for which 3t is maximal in a r (4)-orbit. The subset of .F(4) consisting of r 
such that < 3?r < 1 is a (closed) fundamental region for To (4). Since To (4) 
has index 2 in r (2), the region F{4) decomposes into two components, which 
we denote J r± (4): the first is J r+ (4) = ^(2), consisting of all r lying on or 
above all semicircles of radius 1/2 centred at rationals with denominator 2; a 
closed fundamental region for r (2) is the subset of F{2) consisting of r such 
that < SRr < 1. Secondly, J"~(4) = J"(4) \ T{2). The boundary between these 
is J r+ (4) n J r_ (4), which consists of the union of the semicircles |r + d/2\ = 1/2 
for all odd d e Z. 

The lemma above shows that A 2 is the right choice if and only if the r for 
which 3r is maximal over all t in its ro(4)-orbit is also maximal in the larger 
r (2)-orbit; in other words, given that r e -7 r (4), we in fact have r <G J r+ (4). 

The following lemma then completes the proof of the theorem. □ 

Lemma 12. Let r e J"(4). Then 



Proof. This will follow by continuity from the following facts, for r e J"(4) with 
< < 1: 

1. 5R/(r) = if and only if r lies on the semicircle |2r— 1| = 1 which separates 
the interiors of (4) . 




> 



r e J r+ (4). 
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2. K/(t) > for at least one r <E J r+ (4). 



For the first fact implies that 5ft/ (r) has constant nonzero sign on the two 
interiors. Since f(jr) = — /(r) for 7 g To(2) \ To(4), the signs are different in 
the two interiors; and the second fact establishes that 5ft/(r) is positive in the 
interior of J- + (4) . 

Let / = /(r). Let the roots of X(X 2 + fX + 1) be e x = 0,e 2 ,e 3 . Since 
^2^3 — 1, we have 5ft/ = if and only if 5fte2 = 5fte3 = with the imaginary 
parts 3e2, 3e3 of opposite sign; so ei,e2,e3 collinear, with in between the 
other two roots. Conversely, if the &j are colinear with in the middle then 
(since 6263 = 1) it follows that 5ft/ = 0. However, this alignment of the roots 
happens precisely when the period lattice Ao is rectangular, with orthogonal 
basis W2,wi + W2 , which is when r lies on the semicircle as claimed. This 
establishes the first fact. 

Finally, one can check that for i £ J-" + (4) we have f(i) = 3/y/2 > (equiva- 
lently, \(2i) = (3 - 2y^)/(3 + 2^2) so that |A(2i)| < 1). □ 



5 Chains of 2-Isogenies 

From now on we will use standard Weierstrass models of elliptic curves rather 
than the special forms E^ ab y used above. Thus, let Eg be an elliptic curve over 
C given by a Weierstrass equation 

E : Y^ = 4(X -ef)(X -e^)(X -ef), (4) 

where the roots ej°' are distinct, and Y^i=i e j°^ = 0- We consider the ordering 

of the roots ej ' as fixed, with the point To = (e^ ', 0) of order 2 as distinguished. 
Let 

„ jo) h __l,/I(o) JO). 

the choice of signs will be discussed below. Via a shift of the A-coordinate 
we have Eq = E{ agbo ^, and the choice of signs determines the point Pq = 

(e^ + a bo, 2aobo(a + b )) of order 4 such that 2P = T . 

Now consider arbitrary AGM sequences ((a n , & n ))^L starting from (ao, &o)- 
As in [2J, for n > 1 we let 

(n) _ aj + b 2 n ( „) _ aj - 2b 2 n (n) _ bj - 2aj 
~ 3 ' — 3" ' ~~ 3 ' 

These equalities also hold for n = 0, and for all n > the ej- are distinct, 

and satisfy J2^=i e j"' > = 0- Hence each AGM sequence determines a sequence 
(-^n)5£Lo °f elliptic curves defined over C, where E n is given by the Weierstrass 
equation 

E n : Y 2 = A(X n -e i ( l) ){X n -e^ ) ){X n -e ( i l) ). (6) 
Each has a distinguished 2-torsion point T„ = (e^,0). 
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For n > 1, define a 2-isogeny <^„ : E„_ x via (x„,y„) i-> (ir n _i, t/„_i), 

where 



(e 3 n) -4 ,l) )(4 n) -4 n) ) 



_ (n) ' 



_ / (e (")- e ("))( e (")-e(" ) ) \ 

Now ker(v3„) = ((4 n) ,0)), and 

¥>n(T„) = T n _x = 95„((e^,0)). 

The dual isogeny <^>„ : E n _i — > -B„ has kernel (T„_i) 7^ ker(<£> n _i), so is distinct 
from Lpn-i- Each composite o y n +x has cyclic kernel, since 

(<Pn+l (^n+l)) = ¥>n {T n ) = T n -i ^ O. 

Similarly, by tracing the images of T n , we see that all composites of the tp n have 
cyclic kernels. 

This chain of 2-isogenies may be depicted thus: 



1 



3 3 3 
E n -t-J," E n -l 9- • • • -6 Ei < - Eq 



2 1 



2 



2 



The number j next to each arrow originating from E n denotes the point (e^ , 0) 
which generates the kernel of an associated 2-isogeny. 

The construction of this isogeny chain from the original curve E^ depends 
on many choices. The definition of ao,6o depends first on which root is la- 
belled (which determines To and hence Ei), and the order of labelling of 
and e!j . Secondly, the signs for ao, bo were arbitrary; changing just one of 
them changes Pq and hence E%. So, as in the previous section, the unordered pair 
{ao,&o} determines the short isogeny chain E2 — > E\ — > Eq, with {— ao, — bo} 
determining the same short chain. Finally, for each ao, bo, there are many AGM 
sequences, which determine the rest of the chain. 

Note that we can rewrite 4™ given by ([5]) as 

(") 1 1 u (") o u (") 

(n+1) _ e l T 6Un n (n+1) _ e l — ^ n n (n+1) _ ~ e l 

e X - 1 , e 2 - - , e 3 - — ^— . 

If (a„, b n ) is replaced by (a„, — b n ) for n > 1, we see that this interchanges e^ n+1 ' ) 
and e 2 n+1 ^ but leaves e 3 ™ +1 ' ) unchanged. This does not change the curve E n +i] 
it only changes the labelling of its roots, which then changes E n+ 2- 
Hence we have established a bijection between 

• The set of all AGM sequences starting at (ao, bo), and 

• The set of all isogeny chains starting with the short chain E2 — > E\ — > Eq . 
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We now consider what happens when n — > oo. From ([5]), we have 



lim ej 



(n) 



2M 2 



lim e 



(n) 



lim e 



(") 



-M 2 



,3 n^-oo n— too o 



(8) 



where M = Mg(ao,6o) for some set S C Z>o- The "limiting curve" Eoo for the 
sequence (E n )'^' =0 is the singular curve 



Yl 



4 X 



-M' 



(9) 



Proposition [T] implies the following. 



Proposition 13. T/ie singular point of E^ is a node if and only if the AGM 
sequence (a n ,b n ) is good. 

5.1 The associated lattice chain 

For each n > 0, we have E n (C) = C/A„, where A„ is the lattice of periods of 
the differential dX n /Y n . From the definition of (f n (see (f?])), it can be verified 
that each ip n is normalised, in the sense that 



( dX n 



dX» 
Y n 



(10) 



for all n > 1. Hence tp n corresponds to the map C/A„ — > C/A„_i induced from 
the identity map C — > C. Since each (p n is a 2-isogeny and the composites of 
the ip n have cyclic kernels, it is clear that (A„) is a lattice chain in the sense of 
Section [31 

This establishes the commutativity of the diagram (Figure 1), which shows 
the relationship between chains of lattices and chains of 2-isogenies. For brevity 
we denote z H> (p\(z), p' A (z)) by z n- p n {z). 

^ id ^ 



■C/A n 



C/A„_! 



E„ 



fn 



■ -En- 



Figure 1: A chain of isogenics linked with a chain of lattices 

Conversely, given any lattice chain (A n ) starting from Ao, we may recover 
the sequence of curves E n and the chain of 2-isogenies linking them: first, Ai 
determines which root of Eq is labelled e^; then A2 determines the choice of 
signs in the definition of a ,6o; and finally the AGM sequence starting with 
(ao, bo) is determined by the A n for n > 2. 

Thus we have a third set in bijection with both the set of all AGM sequences 
starting at (ao, b ), and the set of all isogeny chains starting with the short chain 
E2 — >• Ei — >• Eq: namely, the set of all lattice chains starting with the short 
chain A D Ai D A 2 . 
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Proposition 14. With the above notation, for all n > 0, 

1. E n = E{ antbn y; 

2. A„ D A Jl+ i D A„ + 2 is a short chain in the sense of Section 3; 

3. A n +2 is the right choice of sublattice o/A n +i if and only if (a n ,b n ) is a 
good pair; 

4- the lattice chain (A n ) is good (respectively, optimal) if and only if the 
sequence ((a n ,b n )) is good (respectively, optimal). 

Proof. For (1), replace x n by x n + e^ in the equation for E n to obtain the 
equation for Ei Un j, n \. The rest is then is clear, using Theorem [TOT □ 

6 Period Lattices of Elliptic Curves 
6.1 General Case 

Let Eq be an elliptic curve over C of the form We keep the notation of the 
preceding section; in particular, the period lattice of Eq is Ao. Each primitive 
period wi € Ao determines a good lattice chain (A„) where A„ = (wi) + 2 n Ao, 
and conversely, since n„A„ = (u>i). So we have a bijection between the set of 
primitive periods of Ao (up to sign) and good lattice chains. Each good lattice 
chain in turn determines a good AGM sequence ((a n ,b n )) starting at a pair 
(a ,b ) such that E = E {aoM} . 

We now show that the period w\ may be expressed simply in terms of the 
limit of the associated AGM sequence. It will follow that every primitive pe- 
riod w\ of Eq may be obtained from the limit of an appropriately chosen good 
AGM sequence. Conversely, we may express the set of all limits of AGM se- 
quences starting at (ao,&o) m terms of periods of Eq. We will also show that 
optimal AGM sequences give periods which are minimal in their coset mod- 
ulo 4Ao, and super-optimal sequences (where the initial pair (ao, &o) also good) 
give periods which are minimal modulo 2Ao. By Lemma [6j we will be then able 
to express a Z-basis for Aq in terms of specific AGM values. 



Proposition 15. Let (A n ) be a good lattice sequence with limiting period w\ 
(generating PlA n , and defined up to sign). Then for all z G C \ Aq we have 







{- 


r 








7T 


< 






Wi 



1 1 



sin (ztt/wi) 3 
/ cos(zn/wi) 
sin 3 (z7r/wi) 



Proof. Since wi is primitive, there exists u>2 € C such that A n = (wi, 2 n u)2) for 
all n > 0. In the standard series expansion 



z z L — ' V (z — wr w 
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we set w — miwi + m-^wi with m\,m2 not both zero. As n — > oo all terms 
with mi ^ tend to zero, leaving 



lim p A „ (z) = V 



1 1 / 7T X 1 



(z - mwi) 2 3 \wi 

Using the expansion tt 2 / sin 2 (7rz) = X^mez V( z — ™) 2 I this simplifies to the 
formula given. 

For lirrin^oo p' A (z), we may either differentiate this, or apply the same ar- 
gument to the series expansion of p' A ^(z). □ 

Corollary 16. In the above notation, let (A n ) be a (good) lattice chain, with 
limiting period w\, associated to the elliptic curve Eq and the (good) AGM 
sequence ((a n ,b n )) with non-zero limit M = Ms(ao,bo). Then M — ±ir/wi, so 
that the period w\ may be determined up to sign by 

wi = ±Tr/M s (a a ,bo). 

Proof. For all n > we have p\ n (wi/2) — e£ n ' . Letting n — > oo and using the 
proposition we find that 

-M 2 = lim e[ n) = -(- 

3 n-^oo 3 \Wi 

from which the result follows. □ 

The ambiguity of sign in this result will not matter in practice: changing 
the sign of u>i does not change the lattice chain, and neither does changing the 
signs of both ao, bo (and hence the sign of Mg(ao, bo))- 

For fixed (oo,&o)j the value of Mg(ao,&o) depends on the set S of indices n 
for which (a„, b n ) is bad. Changing S, we obtain different AGM sequences, and 
different lattice chains, but these all start with the same short chain (A n ) 2 l=0 , 
and the periods given by n/Ms(ao,bo) are all in the same coset modulo 4Ao. 
We may now establish the result stated above as Proposition [IJ3): 

Corollary 17. |Ms(ao,6o)| attains its maximum (among all AGM-sequences 
starting at (ao,bo)) if and only if the sequence is optimal. 

Proof. By Corollary [TH Mg(ao,6o) is maximal (in absolute value) if and only 
if the limiting period w\ = t: /Ms(ao,bo) is minimal. By Proposition [71 this is 
if and only if the lattice chain is optimal. By Proposition [TW4) . this in turn is 
if and only if the AGM sequence is optimal. □ 

Corollary 18. 1. The optimal value M — M(ao,bo) gives a period w\ = 
tt/M which is minimal in its coset modulo AAq. 

2. |Af(ao,6o)l > |Af(ao,-6o)| ^ ko - &o| < K + 6o|- 

3. 7/(ao,6o) is good, then ir/M(ao,bo) is minimal in its coset modulo 2Aq. 
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Proof. Changing the sign of 60 (only) does not change Ai (or E\), but does 
change A2. The effect on w\, therefore, is to change its coset modulo 4Ao while 
not affecting its coset modulo 2Aq. By Proposition [TOJ A2 is the right choice 
if and only if (ao,fro) is good. Hence, to obtain a period minimal in its coset 
modulo 2Ao, and not just modulo 4Ao, we choose the sign of fro so that the 
pair (do, fro) is good, and then take an optimal AGM sequence. □ 

Theorem 19 (Periods of Elliptic Curves over C, first version). Let E be an 

elliptic curve over C given by the Weierstrass equation 

Y 2 = 4(X-e 1 )(X-e 2 )(X-e 3 ), 



with period lattice A. Set ao — \fe\ — e 3 and fro = \/e\ — &i, where the signs are 
chosen so that (ao,fro) is good, i.e., |ao — fro| < |«o + frol* an d let 



M(a ,fr ) ! 



using the optimal value of the A GM. Then wi is a primitive period of E, and 
is a minimal period in its coset modulo 2 A. 

Define W2, W3 similarly by permuting the ej; then any two ofuui,W2, W3 form 
a Z-basis for A. 

Proof. Everything has been established except the last part. Letting e2,e3 in 
turn play the role of e\ gives minimal periods in each of the cosets modulo 2A, 
so Lemma [6] applies. □ 

Algorithm 20 (Computation of a period lattice basis). 

Input: An elliptic curve E defined over C, and roots ej £ C for j = 1, 2, 3. 

Output: Three primitive periods of E, which are minimal coset representatives, 
any two of which form a Z-basis for the period lattice of E. 

1. Label one of the roots as ei, and the other two arbitrarily as e2, 63; 



2. Set ao = \fe~x — e$ with arbitrary sign, and then &o = ±^/ei — e2 with the 
sign chosen such that | ao — fro | < | ao + fro | • 

3. Output w = tt/M (ao, fro), using the optimal value of the AGM. 

4. Repeat with each root ej in turn playing the role of e\. 

Instead of computing 102, W3 by permuting the ej as in Theorem ll9l we may 
alternatively obtain all Wj by using a single ordering of the roots and three 
different AGM computations. 

Starting with an arbitrary ordering of the roots, say (ei, e%, e^), define a and fr 
as before, up to sign, by o? — e\ — e% and fr 2 = e\ — e^, and also define c (up 
to sign) by c 2 = e^ — e^, so that a 2 = fr 2 + c 2 . We would like to determine the 
signs of a, fr, c so that all three of the following conditions hold: 

|a-fr|<|a + fr|, \c-ib\ <\c + ib\, \a-c\<\a + c\. (11) 

We claim that this is always possible. To see this, first choose the sign of a 
arbitrarily. Then choose the signs of fr and c so that the first and the third 



16 



conditions in (|lip hold. Finally, if the second condition fails, one can easily 
check that if e\ and are interchanged and a, b, c replaced (in order) by ia, ic, 
ib, then all three inequalities will hold. 

We can now state an alternative theorem for obtaining a Z-basis for the 
period lattice A of E. 

Theorem 21 (Periods of Elliptic Curves over C, second version). Let E be an 
elliptic curve over C given by the Weierstrass equation 

Y 2 =4(X-e 1 )(X-e 2 )(X-e 3 ), 

with period lattice A. Order the roots (er,e 2 ,e3) of E, so that the signs of 
a = \fe~x — es, b = ^Je\ — e~2~, c — V e 2 — e 3 ma V be chosen to satisfy all the 
conditions of (| 1 1 [) . Define 

IT IT ill 

Wl = 777 — 77 ' W2 = 777 — 77' w 3 = 777 T' 

M[a,b) M(c,ib) M(a,c) 

Then each Wj is a primitive period, minimal in its coset modulo 2A, and any 
two of the Wj form a Z-basis for A. 

Proof. Let (ei,e 2 ,e3) be an order of the roots of E$. Interchanging e\ and e^ 
if necessary, define a = \fe~\ — e$, b = \Je.\— e2, c = \/e<i — e^, with the signs 
chosen so that all three inequalities in ([TTjl hold. 

Now wi — Tt/M(a,b) is primitive and minimal in its coset as before, since 
(a, b) is good. Using (e[, e' 2 , e' 3 ) = (e2,ei,e3), we find that (a', 6') = (c, ib) 
is good, and set W2 = ir/M(a',b') = ir/M(c,ib); and using (e'{, e^eg) = 
(e3,e2,ei), we see that (a",b") — (ia,ic) is good, and set w% — n/M(a" ,b") — 
ni/M(a,c). □ 



We complete this section by considering two special cases, which arise when 
considering elliptic curves defined over the real numbers, separating the cases 
of positive discriminant (rectangular period lattice) and negative discriminant. 

6.2 Special Case I: Rectangular Lattices 

For the rest of this section, we set i = ■</—!. Recall that if \ao — bo\ = \ao + bo\, 
then both (ao,±&o) are good and 5R(6o/ao) = 0. Then 

= (bo/a ) 

e 3 - ei 

is real and negative. Geometrically, this means that the ej are collinear on the 
complex plane with ei in the middle. 

To see what the associated period lattice looks like, let w = 7r/Af(oo, bo) and 
w' = Tr/M(ao, —bo). Then w,w' are both minimal elements in the same coset 
modulo 2Ao. By Lemma the periods wi,W2 = (w±w')/2 form an orthogonal 
Z-basis for Ao, and the period lattice is rectangular. Alternatively, we could 
obtain a Z-basis for Ao by computing two periods (as in Theorem ll9[) using the 
two other roots of E which are not "in the middle" in the role of e\. 

Finally, we note that whenever the ej are collinear, we can "rotate" them 
by a multiplying by a suitable constant in C* so that the scaled roots e'j are all 
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real. Then one could use an algorithm for computing period lattices of elliptic 
curves over M (e.g. [5J Algorithm 7.4.7]) to compute the period lattice of the 
elliptic curve {Y'f = 4(A' ~ e[)(X' - e' 2 )(X' - e' 3 ). The period lattice of our 
original elliptic curve is then obtained after suitable scaling. This may be more 
efficient in practice, since only real arithmetic would be needed in the AGM 
iteration. 

If the ej are all real (as is the case for an elliptic curve defined over R with 
positive discriminant), we may order them so that e± > e 2 > e% and obtain a 
rectangular basis for the period lattice by setting 



wi = w/M(y/ei - e 2 , Vex - e 3 ), w 2 = ni/M(y/e 2 - e 3) Vex- (12) 

with all square roots positive; then w\ and W2/1 are both real and positive. 
These familiar formulas may be found in [3J Algorithm 7.4.7] or [5J (3.7.1)]. 

6.3 Special Case II 

If the roots of E are such that 
ei - e 2 



ei - e 3 



1 with ei - e 2 7^ ±(ei - e 3 ), 



then geometrically the ej lie on an isosceles triangle having e% as the vertex 
where the sides of equal length intersect. As before, one can rotate this triangle 
by a suitable constant in C* so that e\ £ R, and e 2 , are complex conjugates. 
This yields a new elliptic curve £?', defined over R, whose Weierstrass equation 
has only one real root. 

Again, one could use an algorithm for computing period lattices of elliptic 
curves over R (e.g. [3J Algorithm 7.4.7]) to compute the period lattice of E', 
This is of the form A' = (w[, w' 2 ), for some w[, w' 2 satisfying 

w[eR, »(«/ 2 ) = ^-. 

The period lattice A = (u>i,ui 2 ) of E, with 5ft(w 2 /wi) = 1/2, can then be 
obtained by a suitable scaling of w[ , w' 2 . This will be illustrated in Example [4] 
For real curves with negative discriminant, we present here a simplification 
of the purely real algorithm given in [3J. Let e\ be real and e 2 ,e3 complex 
conjugates, ordered so that 9e 2 > 0. Set ao = V e i — e 3 — x + yi; since e\ — 
lies in the upper half-plane, we may choose the sign of ao so that x, y > 0. Set 
r = \J x 2 + y 2 > and bo = V e i ~ e 2 = x — yi. Now we may obtain a real 
period w + from 

w + = w/M(ao, bo) = tt/M(x + yi,x — yi) = ir/M(x, r), 

and an imaginary period W- from 

iy_ = n/M(—ao, bo) — iri/M(y — xi,y + xi) — iri/M(y, r). 

Note that both AGMs appearing here, M(x,r) and M(y,r), are classical (real 
and positive). These periods span a sublattice of index 2 in the period lattice, 
for which a Z-basis may be taken to be w± — w+ and w 2 = (w + +w—)/2, where 
^t(w 2 /w 1 ) = 1/2. 
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7 The complete set of AGM values 



In 1800, Gauss described the complete set of values of Ms(a,b) as S ranges 
through all finite sets. The proof given by Cox in [H Theorem 2.2] uses theta 
and modular functions related to the modular functions which appeared earlier 
in this paper. Other proofs are also available in the literature, for example by 
Geppert [7]. 

We will give here a slightly more general form of the result than that stated 
in [3], and give an alternative proof which brings out clearly the relation with 
period lattices of elliptic curves. 

In the following statement, we set Ps(a,b) = ir /M$(a, b) (for any finite 
S C Z >0 ) and P(a,b) = n/M(a,b). 

Theorem 22. For a, b G C* with a ^ ±b, let -E{ a ,fc} be the elliptic curve over 
C given by the Weierstrass equation 

E {aM : Y 2 =4X(X + a 2 )(X + b 2 ), 



and let A be its period lattice. Let c = V 'a 2 — b 2 , with the sign chosen so that 
the pair (a, c) is good, and set 

wi = P(a, b), W3 = iP{a, c). 

Then A = ZiUi + TLwj,, and the set of values of Ps(a, b) is precisely the set of 
primitive elements of the coset w\ + 4A. More precisely, we have the following: 

{Pg(a, b)} = {w 4A, w primitive}; 

{Ps(a, —b)} = {w £ w\ + 2^3 + 4A, w primitive}; 
{Ps(—a, —b)} = {w € — Wi + 4A, w primitive}; 
{Ps(—a, b)} — {w G — Wi + 2w% + 4A, w primitive} . 

Thus, the complete set of all values of Pg(±a, ±6) is the set of primitive elements 
of the coset W\ + 2 A. 

Proof. Since A is invariant under translations of the A-coordinate, we may apply 
Theorem I2T1 to see that A = Zw[ + ZW3 where W3 (as given) is a minimal coset 
representative, and either 

• (a, b) is good and w[ = w\; or 

• (a, b) is bad and w[ = W\ ± 2u>3. 

In either case, A = 1av\ + Zw^. 

Now the values of Ps(a,b) are precisely the primitive periods in the same 
coset as wi = P(a, b) modulo 4A. Secondly, Ps{—a, —b) = — Pg(a, b) = —Wi, so 
the values of Ps(—a, —b) are the primitive periods in the coset —w\ (mod 4A), 
as required. Next, P(a, —b) is the minimal period in the coset w\ + 2ws + 4A, 
since this is the other coset modulo 4A contained in w\ + 2A, so the values 
of ±Ps(a, —b) are also as stated. □ 

Corollary 23. Let a, b, c e C* satisfy a 2 — b 2 + c 2 . Define w — n/M(a, b) and 
w' = iri/M(a,c), where (a, c) is a good pair. Then 
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1. A = Zw + Zw' is a lattice in C; 

2. the set of values of n/Ms(a,b) is the set of primitive elements of the coset 
w + 4A; that is, the set 

{uw + vw | u,v G Z, gcd(u, v) = 1, m — l = u = (mod 4)}; 

5. ifte set of values of ir/Ms(±a, ±6) is £/ie set of primitive elements of the 
coset w + 2A; £/ia£ is, £/ie set 

{uw + vw' \ u,v £Z, gcd(w, u) = 1, u — 1 = w = (mod 2)}. 

8 Elliptic Logarithms 

We now extend the method for computing periods of elliptic curves in Section [5] 
to give a method for computing elliptic logarithms of points on elliptic curves. 

Let E be an elliptic curve over C given by a Weierstrass equation as before, 
and A the lattice of periods of the differential dX/Y on E, so that E(C) = 
C/A. An elliptic logarithm of P £ E(C) is a value zp £ C such that P = 
(p\(zp), p' A (zp)). Note that zp is only well-defined modulo A. We wish to have 
an algorithm which can compute the numerical value of the complex number zp, 
to any required precision, from the coefficients of E and the coordinates of P 
(which we assume are given exactly, or are available to arbitrary precision) . 

Construct as before an isogeny chain (E n ) with Eq = E, with associated 
lattice chain (A„) (with Ao = A) and AGM sequence (a n ,b n ). We will assume 
that the chain is super-optimal with \a n — b n \ < \a n + b„\ for all n > 0. (This 
is possible except when Ao is rectangular, and even then is possible for two of 
the three super-optimal sequences). Let u>i,u>2 be a Z-basis for A such that 
A„ = (mi, 2 n w-2) for all n > 0. We have 2-isogenies <p n : E n — > E n -\ for n > 1, 
induced by the natural maps C/A„ — > C/A n _i. 

8.1 Coherent point sequences 

Consider sequences of points (P n )%Lo where P n £ E n (C) satisfy ip n (P n ) = 
P n -i for all n > 1. Such a sequence will be called coherent if there exists 
z £ C such that P n = p n {z) for all n > 0; here, as above, we write p n {z) 
for (pA n (z), p' A (z)). If such a z exists, it is uniquely determined modulo HA„ = 
Aoo = (wi). 

In general there are uncountably many point sequences with a fixed starting 
point Po, since for each P n £ E n (C) there are two points P n +i € E n+ i(C) with 
(p n +i(Pn+i) — Pn- However, only countably many of these are coherent, since 
Pq 1 (Po) is a coset of A in C, and hence countable. 

For example, taking z = shows that the trivial sequence (O n ), where O n is 
the base point on E n , is coherent. Also, the sequence with P n = T n = (e^ , 0) 
is coherent, via z = wi/2. 

Given a point sequence (P n ), for each n let C n = p^ l 1 {P n ) C C be the 
complete set of all the elliptic logarithms of P n , which is a coset of A„ in C. 
Since A n+ i has index 2 in A„, each C n is the disjoint union of two cosets of A n+ i, 
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one of these being C n +i; the other is the set of elliptic logarithms of the second 
point P' n+1 G E n+ i(C) such that tp n+ i(P' n+1 ) = P„. Thus we have 

Co D C\ D ■ ■ ■ D C n D C„+i D 

The point sequence is coherent if and only if Coo = n%L C n 7^ 0, in which case 
Coo is a coset of Aoo in C. 

An argument similar to that used above for Lemma [3] shows the following. 

Lemma 24. The sequence (P n ) is coherent if and only if Cn+i contains the 
smallest element of C n for almost all n > 0. 

8.2 The elliptic logarithm formula 

Proposition 25. With notation as above, let (P n ) be a coherent point sequence 
determined by z G C. Assume that 2z g" A M . Then for n sufficiently large, we 
have P n ^ O n , and write P n = (x n ,y n ). Let Poo = (ik,,^) G E^C) be the 
limit point, defined by (x 00,2/00) = lim„^oo(£n, Vn)- Set M — n/wi, and 

too = -^2/oo/(Xoo +M 2 /3). 

Then too 7^ 0, oo, and (modulo Aoo) we have 

1 /M\ t»i / i \ 
z = — arctan — = — arctan . (13) 

M \tooJ 7T \wrfoo) V ' 

Proof. Since z G" Aoo, for all n we have z $ A n , so that P n ^ O n . Propo- 
sition Qj}] gives expressions for the coordinates of Poo = (xocVco) G Eoo(C) in 
terms of M, s — sui(ztt/wi) and c = cos(z7r/wi): 




Note that s ^ 0, since z £ Aoo', also, s ^ ±1 (and c ^ 0) since 2z $ Aoo- Thus 
Xoo + M 2 /3 = M 2 /s 2 ^ 0, and = -±yoo/(zoo + M 2 /3) = Mc/s ^ 0, giving 
formula (1131) . Taking different values of the multiple- valued function arctan 
changes z by integer multiples of i«i ; so this formula gives a well defined value 
for z modulo Aoo, as desired. □ 

This result does also apply when z — ±wi/2 (mod Aoo), for then s = ±1 
and c = 0, so Xoo + M 2 /3 — M 2 and j/00 = 0, giving too = and z = W\; this is 
the case we used above to compute periods. 

Proposition [25l and in particular formula ([TBI , is the key to our elliptic 
logarithm algorithm, in which we will compute a sequence (t n ) iteratively such 
that limi„ = too- However, we derived (12) by starting from a value of z G C, 
rather than from the coordinates of a point P = p(z) G E(C). In order to 
produce an algorithm for computing z from the coordinates of P, we must show 
how to construct inductively a suitable coherent sequence of points, so that the 
limits Xoo, J/00 and too exist. We will do this in the next subsection. 

Remark. Our formula (|13[) is similar to the one used in Cohen's algorithm [3, 
Algorithm 7.4.8] for computing elliptic logarithms of real points on elliptic curves 
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defined over R. The variable denoted c„ in [3] is related to our t n (denned below) 
by = f„ + a„; setting Coo = lim^oo c„, so that c 2 ^ = t^+M 2 , we can rewrite 
zp as 

1 . / M\ 

zp = ± — arcsm , 

M \ Coo J 

which is similar (up to sign) to the output of Cohen's algorithm. This approach 
leaves an ambiguity of the sign of zp , which is resolved in [5] by considering the 
sign of ?/o at the end, something which is only possible in the real case. Using 
too instead of Coo avoids the ambiguity. 

8.3 The elliptic logarithm iteration 

Let P = (x,y) € E(C), where as above E is the elliptic curve with equation 

E: Y 2 = 4(X-e 1 )(X-e 2 )(X-e 3 ). 

In order to compute the elliptic logarithm zp of P using (|13l) . we need to find 
a suitable coherent point sequence (P n ) starting at P = P. We iteratively 
compute Pi, P%, . . . , using the explicit formulas for the isogenies (p n ; at each 
stage there are two possible choices for P n , determined by choosing a specific 
sign for a square root. The main issue is how to make these choices in such a 
way that the sequences converge. 

It is simpler in practice to use alternative models for the elliptic curves in 
the sequence, in which the isogeny formulas are simpler. We introduce these 
now. Let E[ be the curve with equation 

E[: R 2 = (T 2 + a 2 )/(T 2 + b 2 ). 

We regard E[ as a projective curve in P 1 x P 1 , with points at infinity given by 
(t, r) — (oo, ±1), (±bi, oo). 

Define a map a : E[ -> E bjS (t,r) i-> (x,y) = (t 2 + ei,-2rt(t 2 + b 2 )), 
where as usual a 2 — e\ — and b 2 = e\ — e%. This map is unramified and 
has degree 2; it sends (oo,±l) H> Oe, (±bi, oo) k> (e2,0), (0, ±a/b) H> (ei,0) 
and (±ai,0) n- (e 3 ,0). 

Write ax, b\ for the arithmetic and geometric means of a, b as usual, set 

ei = {a\ + bf)/3 = {a 2 + 6ab + b 2 )/l2, 
e' 2 = (af - 26?)/3 = (a 2 - 6ab + b 2 )/\2, 
e' 3 = (b 2 1 -2aj)/3 = -(a 2 + b 2 )/6, 

so that Ei has with Weierstrass equation 

Ei : Y 2 = A(Xi - e'i)(Xi - e' 2 ){X x ~ e' 3 ). 

Now E[ = Ei via the isomorphism 9 given by (t, r) <— > (xi, yi) where 

(xi,yi) = { l -{t 2 + r(t 2 + a 2 ) + l -{a 2 + b 2 )),t(t 2 + r(t 2 + a 2 ) + \(a 2 + b 2 )), 
2 The sign of y here is chosen to avoid a minus sign in the elliptic logarithm formula (1 1 3 1 > . 
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with inverse 



(xi,yi) >->• (t,r) 



3yi 



12xi + 5a 2 - b 2 



6x1 + a 2 + b 2 ' 12xi + 56 2 - 



The composite a o O^ 1 : E\ —> E[ — > E is the 2-isogeny denoted <p in Section [5] 
Given a complete 2-isogeny chain (£ , n ) n >o with Po = E, as in Section^ we 
define for each n > 1 a curve i?4 with equation P 2 = (T 2 + a 2 l _ 1 )/(T 2 + b 2 l _ 1 ), 
isomorphic to E n via 6 n (defined as for 9 — 6\ as above); these fit into a 
commutative diagram 



EL 



Pn 



E 'n-1 



En- 



s' 



Ei > E 




where (p' n : E' n — > E' n _ 1 is the 2-isogeny which makes the diagram commute. A 
little algebra shows that tp' is given by 



a n -2r n - Qn-i 

t n + a n-ib n -2 -b n - 2 r 2 + a„_i 



For any point sequence (P n ) (with P n G P„(C) and yj n _)_x(-P«+i) = Pn for 
all n > 0) we set P' n = {r n ,t n ) = 0^ 1 (P„) € K( C ) for ™ > 1- SinCG «( p i') = Po, 
we have 



2 2:0-63 

r i = , 

x - e 2 



and 



Vo 



2n{x - e 2 ) 



note that these equations determine r\ (and then t\) up to sign. Next, from 
(p' n (P n ) = P„_i for n > 2, we have 



a n _i(r n _i + 1) 

&n-2^n-l + On-2 



and 



again, these determine (r n ,t n ) up to sign. 

Hence we may construct all possible point sequences (P^) with P^ 6 E' n {C) 
for n > 1, starting from Pq = (xo,yo) G Eq(C) with j/o 7^ 0, by initialising 



xq - e 3 
x - e 2 : 



and 



2/0 



2n(x - e 2 ) 



to determine P[ — (r\,ti), and then iterating the following to obtain P' n — 
(r n ,t n ) for n > 2: 



1) 



b n -2r n -i + a n - 



and 



Suitable choices of signs of r n will be discussed below, which will ensure that 
these sequences converge. Then we will have = limr„ = 1 and = \imt n 
satisfying 

Xoo=t 2 ao + \m 2 , Voa = -2t«,(£, + M 2 ), 



23 



where M = AGM(a, b) as usual. It follows that 

_ -Voo/2 
to ° Xoo + Mt/3' 

as in the statement of Proposition [2SJ 

8.4 Choice of signs in the iteration 

We now show that we do obtain coherent, convergent sequences, provided that 
for all (or all but finitely many) n we choose the sign of r„ so that 5ft (r n ) > 0; 
always assuming that the isogeny sequence itself is optimal. 

Proposition 26. With the notation of the previous section, assume that the 
AGM sequence satisfies 3t(a n /b n ) > for all n > 0. 

If$tr n > for all n > 1, then the point sequence (P n ) = (0 n (r n ,t n )) deter- 
mined by the iteratively defined sequence of pairs (r n ,t n ) is coherent. 

The same conclusion holds if 5ftr„ > for all but finitely many n > I. 

Proof. Recall that A n is the period lattice of E n for n > 0, with Z-basis w\ 1 W2 
such that wi — n/M(ao, b ) generates n„A„, and A„ = (wi,2 n W2) for all n > 0. 
So for each n there exists z n G C, uniquely determined modulo A„, such that 
x n = PA n {z n ) and y n — p'^ (z n ). We wish to show that the z n may be chosen 
independently of n. 
Since 

= 12z„ + 5a|_i - b 2 n _ x 
12x n + 5bl_ x - a\_y 

we may regard r n as the value at z n of an elliptic function /„ of degree 2 with 
respect to A„. Similarly its square, 

(n-i) 

r — 

is the value at z n of which is an elliptic function with respect to the larger 
lattice A n _i. It follows that 

f n {z + 2 n - 1 w 2 ) =-f n (z) 

for all z € C and all n > 1. 
Since 

Pn(0) - E = 0„((oo, 1)) 

and 

p„K/2) = (e^,0) = ^((Cc-x/fin-x)), 

we have / n (0) = 1 and f n {w\/2) — a„-i/6 n -i for all n > 1. 

We now consider the preimage of the right half-plane under /„, for 
n > 1. Since f n {w\/2) — a n -\jb n -\ and 3?(a„_i/6„_i) > 0, this contains w±/2 
for all n. Let 72.° denote the connected component of 7Z n which contains W\/2. 
Both lZ n and 7?.° are invariant under translation by w\ (by periodicity of f n ), 
and lZ n is the union of all translates of W n by multiples of 2™w 2 . The preimage 
of the left half-plane under /„ is C n = 7Z n + 2 n ~ 1 W2, which is the union of the 
translates of 72.° by odd multiples of 2 n ~ 1 W2- 
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Consider a point P n = p n (z n ) 6 E n (C), where z n £ 7\L°. Its preimages 
in E n+1 (C) are p n +i(z n ) and p n+1 (z' n ), where z' n = z n + 2 n w 2 - One of z n , z' n 
lies in lZ n+ i, the other in C n+ \. Since ii>i/2 € 1Z° k for all fc, one can show that 
TZ n C li-n+i ( see Lemma [57] below). Hence, in fact, z n £ 7£° +1 and z' n £ C n +i- 

Hence, by choosing the sign of each r n for n > 1 so that it lies in the right 
half-plane (for all n > 1), we ensure that each P n = p n (z n ), where z n £ TZ° does 
not depend on n. Hence the associated point sequence is coherent, as required. 

For the last part, if 5Rr„ > only for n > no > 0, then we simply apply the 
above argument to E no and (P n )n>n , noting that P no is a lift of Po to E no (C), 
and that every elliptic logarithm of P na is also one of Po ■ D 

Lemma 27. In the notation of Proposition^^ c TZ° l+1 for all n>\. 

Proof. It suffices to show that $tf n +i{z) has constant sign for z £ 7?.° , since this 
sign is positive for z = w\/2 £ W n . If not, then there exists z £ 11° such that 
$tfn+i{ z ) < 0, so f n+ i(z) 2 is real and negative. We show this to be impossible. 
We have 

2 

C t n-2 r n ~ a n-l , , 2 \ / \ 

-o n -iri + a„-i 

say, where h n is the linear fractional transformation 

a-n-2Z — a n -\ 
-b n - 2 z + a n -i 

and g n {z) — h n (z 2 ). This implies that 

fn(z) = 9n+l{fn+l(z)) = h n+1 (f n+1 (zf). 

To complete the proof we show that the image of the negative real axis 
under h n is contained in the left half-plane, for all n > 1. Let t £ R be negative, 
and set s = It — 1 < — 1, and a = a n -2,/b n -2) then 

so? — 1 

h n (t) = , 

a — s 

and we leave it to the reader to check that this has negative real part when 
s < -1 and 3?a > 0. □ 

We remark that this lemma implies that we always have $tr n > for n > 2. 
It is possible to have 5iri = 0; this occurs if and only if xq lies on the open line 
segment between e 2 and e^. 

8.5 The elliptic logarithm algorithm 

We summarise this section with the following algorithm. 

Algorithm 28 (Complex Elliptic Logarithm). Given an elliptic curve E defined 
over C by the Weierstrass equation Y 2 = 4(X — ei)(X — e 2 )(X — 63), and a 
non-2-torsion point P £ E(C), compute an elliptic logarithm of P. 

Input: E, with roots e\,e 2 ,e%, and P = (x , y ) £ E(C), with y ^ 0. 
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1. Set ao = V e i — e 3 an d = V e i — e 2i choosing the numbering of the 
roots (if necessary) and the signs so that \clq — bo\ < \ao + 6q|. 



2. Set r = y/(x - e 3 )/(x - e 2 ), with 5Rr > 0. 

3. Set i = -y Q /(2r(x - e 2 )) (so < 2 = x - ei). 

4. Repeat the following, for n — 1,2,...: 

(a) set 



0"n — 2 ' n — V a n-l°n-l) 

choosing the sign of b n so that \a n — b n \ < \a n + b n \; 



(b) set r <— \Ja n (r + l)/(b n -ir + a„_i), with 3?r > 0. 

(c) set i rt. 

until |a rl /6 n — 1| and \r — 1| are sufficiently small. Set M = limo n . 
Output: 

1 (M\ 
zp = — arctan — 
M \t ) 

Note that the output value of zp may not be in the fundamental paral- 
lelogram of the period lattice A. However, assuming that the usual range for 
the arctan function is used, where —tt/2 < -ft arctan(x) < tt/2, we will have 
zp = xwi + iyw\ with x, y € R and — 1/2 < x < 1/2. 

For points P of order 2, choose the labelling of the roots so that P — (ei, 0) 
and then take zp = Wi/2 =%/ (2M) where M = M(y/ei — €3, \fe\ — e^). 



8.6 The real case 

For elliptic curves defined over R there is some advantage in adapting the algo- 
rithm to use real arithmetic where possible, even though the algorithm as given 
above works perfectly well in this situation. We divide into cases as in sections 
16.21 and 16.31 above. 



8.6.1 Curves with positive discriminant 

Order the roots, which are all real, as in section [6~2l so that e\ > e 2 > 63; the 
real and imaginary periods Wx,w% are then given by (|12p . 

Let P = (x ,yo) G E(R) with 2P ^ (so y a ^ 0). If P is in the connected 
component of the identity of E(M) then xq > ei, and it is immediate from the 
formulae given above that as well as all a„,&„ being real and positive, so too 
are all r„, and the t n are real and with constant sign (opposite to that of yo). 
Hence zp, the output of the algorithm, is real and in the interval \zp\ < w\/2. 

Now suppose that e 2 > xq > e$, so that P is in the other real component. 
Now zp = xp + W2/2 where xp is real, and it suffices to compute xp. To do 
this we may replace P by P' = P + (e^, 0) which is in the identity component 
and has elliptic logarithm equal to xp. A short calculation shows that we may 
compute xp using the usual iteration, with the positive real initial values 

r' = oo/Vei - £0; t' = r'y /2(x - e 3 ). 
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8.6.2 Curves with negative discriminant 



As in !6.3[ we order the roots so that e\ is real and 3e2 > 0. Set ao — y/e% — e 3 = 
x + yi where x, y > 0. The real period is w\ = iv/M{ao, bo) = ir/M(x, R) where 
R = \clq\. Now let \/xq — e 3 = u + iv with u, v > 0, and then set the initial 
values of r and t to r\ = (u + iv)/(u — iv) and t\ = —yo/2(u 2 + v 2 ). 

Applying the first step in the iteration, we find that a\ = x and b\ = R, and 
also that r-i = y/ux/(ux + vy), where the quantity inside the square root is real 
and positive, so we may take r-i > also, and £2 = ?"2ii which is also real and 
with the opposite sign to j/o- Now the rest of the iteration may be carried out 
using real values for all quantities, and again the output value zp is real and 
satisfies \zp\ < w\/2. 



9 Examples 

In the following examples, we will illustrate our method for computing the 
period lattices of elliptic curves over C, and the elliptic logarithms of complex 
points. These examples were computed using the MAGMA implementation by 
the second author. All complex numbers in our examples are computed correctly 
up to 100 decimal places, but only the first 20 decimal places will be shown. 
Note that we implemented our own function for computing optimal AGM values, 
since the standard function in MAGMA does not always return an optimal one. 

Example 1. Let E be the elliptic curve over C given by the Weierstrass equa- 
tion 

E: Y 2 = 4(X - ex)(X - e 2 )(X - e 3 ) 

with 

ei = 3 — 2i, e 2 = 1 + i, e 3 = — 4 + 

Observe that Ylj=i e j — 0- We will compute the period lattice of E using the 
method described in Theorem [5T] To do this, first we let Eq = E and calculate 



ao = \/ei - e 3 , b = \fe~\ - e 2 , c = \J - b% 
where the signs of ao, bo, cq are chosen so that (JTTJ) holds, i.e. 

|«o — &o| < l« + fool, Wo - co| < \a + c |, I co - i&o| < Wo +^o|- 
In this example, one can verify that such ao, bo, Co are 

a = 2. 70331029534753078867... - iO. 55487525889334275023... 
60 = 1.67414922803554004044... - i0.895977476129838I247I . . . 
c = 2.23606797749978969640 .... 

In fact, all conditions in (fn"j) are strictly inequalities in this case, so the period 
lattice of E is non-rectangular. By Theorem [5T1 we have 

wx = 1. 29215151748713051904... -H0.44759218107818896608 . . . 
w 2 = 1.42661373451784507587 ... - iO. 80963848056301882107 . . . 
w 3 = -0.13446221703071455682 . . . + il.25723066164120778715 . . . 
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and any two of Wj form a Z-basis for A (where A is the period lattice of E). In 
our computation, we also have \w\ — w 2 — Ws\ ps 10~ 100 . As expected, these Wj 
are minimal coset representatives of 2A in A. 

Next, we wish to compute an elliptic logarithm of the point 

P= (2- £,8 + 4i) £ E(C) 

(which has infinite order). Using ao,&o as above, Algorithm |2"51 gives 

z P = -0.72212997914002299126 . . . + iO.01717122412650902249 .... 

Note that zp is only well-defined modulo A. Depending on the basis for 
A, the value zp obtained using Algorithm 1281 may not lie in the fundamental 
parallelogram spanned by that basis. In our case, one can check that 

z P = (-0.33249952362000772434 . . .) Wl - (0.20502411273191295799 . . > 2 
= (0.66750047637999227565 . . .) Wl + (0.79497588726808704200 . . > 2 , 

and so zp is not in the fundamental parallelogram spanned by {it>i, ui 2 }. Finally, 
one may verify that, to the given precision, we have, as expected, 

p A (z P ) = x{P), Pa(zp) = y(P), 

and 

p A (wx/2) = e%, p A (u) 2 /2) = e 2 , p A (w 3 /2) = e 3 , 
and p' A (wj/2) w for all j = 1, 2, 3. 

Example 2 (Rectangular Lattice) . Let E be the elliptic curve over C given the 
Weierstrass equation 

E; Y 2 = 4(X - ei )(X - e 2 )(X - e 3 ) 

with 

e 1 = l + 3i, e 2 = -4-12i, e 3 = 3 + 9i. 

Observe that Sj=i e j — an d a H &j are collinear. By letting Eq = E and 
computing ao,&0;Co as before, we have 

a = 1.47046851723128684330 ... - i2.04016608641756892919 . . . 
b = -3. 22578581905571472955... -^2.32501487101070997214... 
c = 2.75099469475848456460 ... - i3.81680125374499001591 .... 

This time, however, we have |ao — &o| — | fl o + bo\, while the other two conditions 
in (1111) are strictly inequalities. Hence we have two minimal elements (up to 
sign) in one coset of 2 A in A (where A is the period lattice of E), and so A is 
rectangular. 

To derive an orthogonal basis for A, first we let w,w' — 7r/M(ao, ±&o)- In 
this example, we have 

w = -0. 29920293143872535713... 10940038117892953702... 
w = 1.14708588706988127437... +i0.06697438037476960963.... 
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One can check \w\ = \w'\. Let w\ = (id + w')/2 and w 2 — (id — w')/2. Then 
w\ 1 w 2 form an orthogonal basis for A, as proved in Lemma [5] Here, we have 

wi = 0.42394147781557795862 . . . + iO.58818738077684957333 . . . 
w 2 = -0.72314440925430331575... + i0. 52121300040207996369.... 

Note that ^(wz/wx) — 0, so both {1111,11)2} is indeed an orthogonal basis for A. 

Let zp be an elliptic logarithm of the point P = (3 + 2i, 28 — 14i) £ E(C) 
(note that P has infinite order). Algorithm [25] shows that 

z P = -0.42599662534207481578... - i0.02491254923738153924 . . . 

= (0.62858224538977667533 . . )u>x + (0.37134662195976180031 . . )w 2 . 

Finally, we verify that 

\ PA (z P ) - x(P)\ « 10~ 98 , \p' A (z P ) - y(P)\ « 10- 97 . 

Moreover, we have 

\p A ( Wl /2)~e 2 \ a 10-" 
\p A (w 2 /2)-e 3 \ « 
|p A («;/2)-ei| a 10-", 

and 

|p A K/2)|alO-", \p' A (w 2 /2)\ « 10-", |p A K2)| « 10- 100 . 



Example 3. Let if = Q(0) where is a root of the polynomial a; 3 — 2. Let E 
be the elliptic curve defined over K given by the Weierstrass equation 

E : Y 2 =4(X-0)(X-l)(X + l + 0). 

Note that if has one real embedding and one pair of complex embeddings. Let 
E\,Ez be the real and complex embedding of E respectively, i.e. 

E x : Y 2 =4(X- \/2)(X - 1)(X + 1 + \/2) 
E 2 : Y 2 = A(X - u\/2){X - l)(X + l + u\/2) 

where ui = exp(2ni/3) is a cube root of unity. Since E\ has three real roots, 
then the period lattice of E\ is rectangular. In fact, by letting e± = \/2, e^ ' = 
l,e^ = — 1 — \[2, we can compute ao,&o, c o satisfying ([TT|l as 

a = 1.87612422291002530767... 
60 = 0.50982452853395859808 . . . 
c = 1.80552514518487755254.... 

One can then verify that \cq — ibo\ = \cq + iba\. As before, we compute 

w = 71 , ^ = 2.90130425944817643666 ... - il. 70677932803214980295 . . . 

M(c ,ib a ) 

7T 



M (c , -ib ) 
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and let w\ 1 W2 — (w ± w')/2. Then w\,W2 form an orthogonal basis for the 
period lattice of E±. In this example, we have wi — 5i(u>) and wi = i$s(w). 

Nevertheless, the period lattice of E2 is non-rectangular, since all roots of 
E2 are not collinear. In fact, by letting = — 1 — uj\^2, = 1, eg '' = uj\/2 
(here we must ensure that do, &0: Co satisfy ([TT]) ). we have 

a = 1. 10851094368231305521... -iO.98431471713501219051... 
b Q = 0.43669517024285334726... - il. 24929666083200513980... 
c = 1. 34004098848655674756... - i0.40712323180652750769 . . . . 

One can check that all conditions in (Tnj) arc strictly inequalities, hence this also 
confirms that the period lattice of E2 is non-rectangular. By Theorem I2T1 we 
finally obtain 

wi = 1. 28194824894788708942... 88277404359595361782... 
w 2 = 2.36557653380849535471 ... - i0.03808700290170419307 . . . 
w 3 = -1.08362828486060826529 . . . + il.92086104649765781090 . . . 

with \wi -w 2 -w 3 \^ IO -100 . 

Example 4. Let E be the elliptic curve over C given by the Weierstrass equa- 
tion 

E: Y 2 = 4{X - ex)(X - e 2 ){X - e 3 ) 

with 

e% = —1 — 3i, e2 = 3 + i, e 3 = —2 + 2i. 

Observe that Y^j=i e j = an d l e i — e 3| = l e 2 — es|. Thus ei,ea,e3 are on an 
isosceles triangle. By letting Eq = E and computing ao, bo, cq as before, we have 

ao = 1.74628455779589152702 il.43161089573822132705 .. . 
b Q = 0.91017972112445468260... - i2. 19736822693561993207... 
c = 2.24711142509587014360...- iO. 22250788030178260411.... 

Hence by Theorem |2"T1 we obtain 

wi = 0.81646689790312614904... + 10773333340066743861... 
w 2 = 1. 36061503191563570645... - £0. 20595647167234558716... 
w 3 = -0.54414813401250955741... + il. 31368980507301302578 .. . 

with \wi —W2 — w$\ s» 10~ 100 . In addition, one can check that ^(wi/ws) = 1/2 
as claimed in Section Let A be the period lattice of E. We finally verify 
that \p A (wj/2) - ej\ « IO" 100 for all 3 = 1, 2, 3, and 

\p' K {wi/2)\ « 10-", |f4(u*/2)| « IO" 100 , 1^(^/2)1 « IO" 99 . 
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